AWS server not reacheable by port 22 pipeline

[Valentino Roca Segura]

I put all the ip in

https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/

but nothing change... pipeline returns time out

[Patrik S · Accepted solution]

Hello  @Valentino Roca Segura ,

and welcome to the Community!

We have recently updated our 1x/2x size option builds to operate from a new, broader IP range.

For teams who need their builds to run from a more restricted set of IP addresses, we recommend using the atlassian-ip-ranges configuration available with our 4x/8x steps. These size options are only available for builds running under a paid Bitbucket Cloud plan (Standard or Premium).This option provides enhanced security by limiting the IP addresses to a smaller, more manageable list. You can find more details about this configuration here. This configuration does not need to apply to all steps in a pipeline, just the steps that access secure resources.

Please Note: Opting for larger step sizes (4x/8x) may impact billing. We encourage you to review the relevant documentation on step sizes here to understand these implications fully.

You can view the complete list of IP addresses used by the 1x/2x steps in this JSON format. This list can be explicitly filtered for EC2 or S3 resources located in us-east-1 and us-west-2. We do not recommend or support adding these IP addresses into your firewall configuration.

The AWS JSON file is divided into CIDR blocks. To help you identify if a given IP address belongs to an Amazon CIDR IP range, you can check the article How to identify the CIDR block of the IP from the Bitbucket pipeline.

Important Note: Relying solely on IP-based firewalls for securing your infrastructure is not recommended. Instead, consider implementing secure authentication methods for any services exposed to Bitbucket Pipelines, such as using OpenID Connect (OIDC).

Alternatively, you may consider utilizing Bitbucket's pipeline runners. Runners enable you to execute builds in Pipelines on your own infrastructure. Additionally, as your runner is hosted on your own infrastructure, you will have greater flexibility regarding the list of IP addresses to permit.

Please feel free to reach out if you have any questions.

Thank you!

Patrik S

[Deleted user]

It seems this got way more complicated than it should.

I added all the IPs v4 and v6 from here:

https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall/

    Valid IP addresses for bitbucket.org, api.bitbucket.org, and altssh.bitbucket.org

    Valid IP addresses for Bitbucket Pipelines build environments

and from here    

https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

  Outgoing Connections

Please could you advise what are the IPs that are missing in that list ? I am afraid if I do something to see the IP in the pipelines logs, then it will change, I am pretty sure that some ips are missing in your list.

[Patrik S]

Hello @[deleted] ,

I'm sorry to hear you're facing difficulties with the changes in the pipelines runtime.

I recently posted a comment on a similar question clarifying how the documentation is divided to provide better clarity on the IP addresses and their usage. I encourage you to read that explanation for a more detailed understanding.

• https://community.atlassian.com/t5/Pipelines-questions/Re-Re-Whitelisted-IPs/qaq-p/2869618/comment-id/87#M87

The issue you are facing might be due to the specific step settings in your Bitbucket Pipelines that determine which IP ranges are in use.

Please review the explanation and let me know if you have any further questions or need additional assistance.

Thank you, @[deleted] !
Patrik S

[Sabin Petru]

I won't add the whole list of AWS IPs, thats insecure and you shouldn't even mention it... Why should I pay a 4x/8x just for the IPs? I don't need that much CPU/Memory. 

This should be fixed.

[Patrik S]

Hello @Sabin Petru  ,

Thank you for sharing your concerns with us.

Our Product Manager has provided additional context and information about this change in a Community post, which we hope will address any remaining questions you may have. You can review it here: 

• Sharing Some Context On Our New Pipelines Step Sizes 

Thank you, @Sabin Petru  !

Patrik S

[Valentino Roca Segura]

Heyyy thank you so much:

this work for me as Patrik said:

- step:

  name: Deploy staging

  deployment: Staging

  size: 4x

  runtime:

   cloud:

       atlassian-ip-ranges: true

[Deleted user]

Yes, this solution works, but it comes with the downside of increased costs due to resizing your VM to handle the CI/CD processes.

It feels unfair for Atlassian to push users to upgrade their infrastructure to maintain the level of security we previously had. This approach seems like a way to drive additional revenue or degrade the service to force upgrades.

Today is possible to keep using x2 sizes, but you must whitelist a lot of IPs that belong to Amazon EC2.(an some S3 if you need to...)

[Deleted user]

I have the exact same problem can someone please fix this ASAP please? The IPs provided in the documentation does not works so some IPs are missing for sure